PT-2026-32346 · Linux · Linux Kernel

Published 2026-04-13 · Updated 2026-05-20 · CVE-2026-31420

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The bridge MRP component fails to validate user-supplied interval values from netlink in the br mrp start test(), br mrp start in test(), and br mrp start in test parse() functions. When an interval of 0 is provided, the delayed work functions br mrp test work expired() and br mrp in test work expired() reschedule themselves with zero delay. This results in a tight loop on system percpu wq that continuously allocates and transmits MRP test frames, leading to system memory exhaustion and a kernel panic via Out-Of-Memory (OOM) deadlock (a state where the system cannot allocate memory to resolve the memory shortage).

Recommendations Apply the fix that implements NLA POLICY MIN(NLA U32, 1) in the nla policy tables for IFLA BRIDGE MRP START TEST INTERVAL and IFLA BRIDGE MRP START IN TEST INTERVAL to reject zero values at the netlink attribute parsing layer.

Fix

Improper Locking

Weakness Enumeration

CWE-667

Related Identifiers

CVE-2026-31420

OESA-2026-2232

OESA-2026-2235

OESA-2026-2236

Affected Products

Linux Kernel

References · 31

• https://nvd.nist.gov/vuln/detail/CVE-2026-31602 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2232 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31680 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2026-31420 · Vendor Advisory
• https://git.kernel.org/stable/c/c9bc352f716d1bebfe43354bce539ec2d0223b30 · Patch
• https://cve.org/CVERecord?id=CVE-2026-31420 · Security Note
• https://osv.dev/vulnerability/OESA-2026-2236 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31407 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2026-31420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31424 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2026-31420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2026-31423 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2026-31782 · Security Note
• https://git.kernel.org/stable/c/fa6e24963342de4370e3a3c9af41e38277b74cf3 · Patch
• https://ubuntu.com/security/CVE-2026-31420 · Vendor Advisory